an operation received by a computer is an unauthorized operation, and 
comprising: 

an operation-receiving means for receiving instruction data for 
executing said operation; 

a f i rst prof i le-creat ion means for creat ing a f i rst prof i le from said 
instruction data related to the operation for which instruction data was 
received by said computer; 

a f i rst prof i le-storage means for storing said f i rst prof i le that was 
created by said first profile-creation means; 

a second prof i le-creat ion means for ident i f y ing the user that executed 
said operation by said instruction data, and creating a second profile 
related to the operation executed by said user; 

a second profile-storage means for storing, according to user, said 
second profiles created by said second profile-creation means; and 

a score-calculation means for comparing said instruction data with 
at least one profile that is stored in said first profile-storage means 
or in said second profile-storage means, and calculating a score for 
determining whether said operation is an unauthorized operation. 

2. The unauthorized-operation-judgment system of claim 1 further 
comprising: 

a first log-data-storage means for storing log data of said computer; 

and 

a second log-data-storage means for storing log data according to user 
of said computer; wherein 

said first profile-creation means references said first 
log-data-storage means when creating said first profile; and 

said second profile-creation means references said second 
log-data-storage means when creating said second profile. 

3. The unauthorized-operation-judgment system of claim 1 further 
comprising: 



a login-detection means for executing a process for detect ing whether 
a certain user is logged into said computer; wherein 

when said login-detection means detects that a certain user is logged 
in, said second profile-creation means creates a second profile related 
to said user. 

4. The unauthorized-operation-judgment system of claim 3 wherein; 
said login-detect ion means executes detect ion processing at specif ied 

intervals while said computer is in operation. 

5. The unauthorized-operation-judgment system of claim 3 wherein; 
when said login-detection means does not detect that a certain user 

is logged in even though detection processing is executed, said first 
profile-creation means creates a first profile related to said computer. 

6. The unauthorized-operation-judgment system of claim 5 wherein; 
said login-detection means executes detection processing at specified 

intervals while said computer is in operation. 

7. The unauthorized-operation-judgment system of claim 1 further 
comprising: 

a third profile-creation means for creating a third profile related 
to an operation executed by a user that is identified as a first-time user, 
when the user executing said operation by said instruction data is 
identified as a first-time user operating said computer for the first time; 
and 

a third profile-storage means for storing third profiles that are 
created by said third profile-creation means; wherein 

said score-calculation means uses at least one prof i le that is stored 
in said third prof i le-storage means instead of said second prof i le-storage 
means to determine whether said operation is an unauthorized operation. 



8. The unauthorized-operation-judgment system of claim 7 further 
comprising: 

an operation-record-storage means for storing, according to user, 
totals related to at least one of the following: number of logins to said 
computer, operation time that said computer has been operated, or number 
of days said computer has been operated; and 

a first-time-user-judgment means for referencing said 
operation-record-storage means, and determining that the user executing 
said operation is a first-time user using said computer for the first time 
when said totals do not satisfy preset reference values; and wherein 

said third profile-creation means creates a third profile for an 
operation executed by a user that is determined to be a first-time user 
by said first-time-user-judgment means; and 

said score-calculat ion means uses at least one prof i le stored in said 
third profile-storage means when said first-time-user-judgment means 
determines that a user is a first-time user, to determine whether said 
operation is an unauthorized operation. 

9. The unauthorized-operation-judgment system of any one of the claims 
1 to 8 wherein 

said score calculation means calculates a score by calculating the 
deviation between said instruction data and data that is stored in said 
prof i les. 

10. The unauthorized-operation-judgment system of any one of the 
claims 1 to 8 further comprising: 

an operat ion-stopping means for execut ing a process for stopping said 
operation when said score value exceeds a reference value. 

11. The unauthorized-operation-judgment system of any one of the 
claims 1 to 8 further comprising: 

a warning-process means for executing a process for displaying a 



warning on the operation screen of said computer, or generating a warning 
alarm on said computer, when said score exceeds a reference value. 

12. The unauthorized-operation-judgment system of any one of the 
claims 1 to 8 further comprising: 

a warning-notification-transmission means for sending a notification 
warning to the administration server operated by the administrator of said 
computer that there is a possibility of an unauthorized operation, when 
said score exceeds a reference value. 

13. An unauthorized-operation-judgment method for determining 
whether an operation received by a computer is an unauthorized operation, 
and comprising: 

a step whereby said computer receives instruct ion data to execute said 
operation; 

a step whereby said computer creates a first profile related to the 
operation for which instruction data was received by said computer, and 
stores said first profile in a first profile-storage unit; 

a step whereby said computer identifies the user that executed said 
operation by said instruction data, creates a second profile related to 
the operation executed by said user and stores said profile in a second 
prof i le-storage uni t ; and 

a step whereby said computer compares said instruction data with at 
least one profile that is stored in said first profile-storage unit or in 
said second profile-storage unit, and calculates a score for determining 
whether said operation is an unauthorized operation. 

14. An unauthorized-operation-judgment method for determining 
whether an operation received by a computer is an unauthorized operation, 
and comprising: 

a step whereby said computer receives instruction data for executing 
said operation; 



a step whereby said computer creates a first profile related to the 
operation for which said instruction data is received by said computer, 
and sends said profile to a first profile-storage unit; 

a step whereby said computer identifies the user that executed said 
operation by said instruction data, creates a second profile related to 
the operation executed by said user, and sends said profile to a second 
profile-storage unit; and 

a step whereby said computer obtains at least one profile from said 
first profile-storage unit or said second profile-storage unit, compares 
said instruction data with said profile(s), and calculates a score for 
determining whether said operation is an unauthorized operation. 

15. An unauthorized-operation-judgment program for determining 
whether an operation received by a computer is an unauthorized operation, 
and causes said computer to execute: 

a step of receiving instruction data for executing said operation; 

a step of creating a first prof i le related to the operation for which 
instruction data was received by said computer, and storing said first 
profile in a first profile-storage unit; 

a step of identifying the user that executed said operation by said 
instruction data, creating a second profile related to the operation 
executed by said user and storing said prof i le in a second prof i le-storage 
unit; and 

a step of comparing said instruction data with at least one profile 
that is stored in said first profile-storage unit or in said second 
prof i le-storage unit, and calculating a score for determining whether said 
operation is an unauthorized operation. 

16. An unauthorized-operation-judgment program for determining 
whether an operation received by a computer is an unauthorized operation, 
and causes said computer to execute: 

a step of receiving instruction data for executing said operation; 



